Commit 0c7a810a authored by William Dean's avatar William Dean Committed by Liu Kai
Browse files

pinctrl: ralink: Check for null return of devm_kcalloc 

stable inclusion
from stable-v4.19.254
commit 13596e6c9e541e90e5fc2c52b23f08b951370da9
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBP3KQ
CVE: CVE-2022-49608

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=13596e6c9e541e90e5fc2c52b23f08b951370da9



--------------------------------

[ Upstream commit c3b821e8 ]

Because of the possible failure of the allocation, data->domains might
be NULL pointer and will cause the dereference of the NULL pointer
later.
Therefore, it might be better to check it and directly return -ENOMEM
without releasing data manually if fails, because the comment of the
devm_kmalloc() says "Memory allocated with this function is
automatically freed on driver detach.".

Fixes: a86854d0 ("treewide: devm_kzalloc() -> devm_kcalloc()")
Reported-by: default avatarHacash Robot <hacashRobot@santino.com>
Signed-off-by: default avatarWilliam Dean <williamsukatube@gmail.com>
Link: https://lore.kernel.org/r/20220710154922.2610876-1-williamsukatube@163.com


Signed-off-by: default avatarLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarLiu Kai <liukai284@huawei.com>
parent 8bb5e053

drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c

+2 −0
Original line number Diff line number Diff line
@@ -267,6 +267,8 @@ static int rt2880_pinmux_pins(struct rt2880_priv *p) 
						p->func[i]->pin_count,

						sizeof(int),

						GFP_KERNEL);

		if (!p->func[i]->pins)

			return -ENOMEM;

		for (j = 0; j < p->func[i]->pin_count; j++)

			p->func[i]->pins[j] = p->func[i]->pin_first + j;